<!doctype html>
<html lang="en">

<head>
	<meta charset="utf-8">

	<title>Reveal JS presentation</title>

	<meta name="description" content="A framework for easily creating beautiful presentations using HTML">
	<meta name="author" content="Hakim El Hattab">

	<meta name="apple-mobile-web-app-capable" content="yes">
	<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">

	<meta name="viewport" content="width=device-width, initial-scale=1.0">

	<link rel="stylesheet" href="libs/reveal.js/4.1.3/reset.css">
	<link rel="stylesheet" href="libs/reveal.js/4.1.3/reveal.css">

	
	
	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css">

	  <!-- highlight Theme -->
  	
	  <link rel="stylesheet" href="libs/highlight.js/11.3.1/styles/monokai.min.css">
	
	
		
	<link rel="stylesheet" href="libs/reveal.js/4.1.3/plugin/chalkboard/style.css">
	
	
	
		<link rel="stylesheet" href="libs/reveal.js/4.1.3/plugin/customcontrols/style.css">
	
	<link rel="stylesheet" href="libs/styles/tasklist.css">



  <!-- Revealjs Theme -->
  
  	<link rel="stylesheet" href="libs/reveal.js/4.1.3/theme/black.css" id="theme">
  
  


  <!-- Revealjs Theme -->
  

 
</head>

<body>
  


  <div class="reveal">

    <!-- Any section element inside of this container is displayed as a slide -->
    <div class="slides">

      


    
        <section >
            
            <p>title: “Markdown slide”
theme: “Solarized”
highlighttheme: “Vs”
author: Wildlinux
date: Feb 20, 2018
output: revealjs::revealjs_presentation</p>
<style type="text/css">
    p { text-align: left; }
    h2 { text-align: left; }
</style>
<h1>MAL_恶意代码分析</h1>
            </section>
    



    
    <section>
        <section >
            <h1>恶意代码</h1>

            </section>
        
            <section >
                <h2>恶意代码定义</h2>
<pre><code>- Malware is a set of instructions that run on your computer and make your system do something that an attacker wants it to do.
- 使计算机按照攻击者的意图运行以达到恶意目的的指令集合。
- 指令集合: 二进制执行文件, 脚本语言代码, 宏代码, 寄生在文件、启动扇区的指令流
- 恶意代码目的: 技术炫耀/恶作剧, 远程控制, 窃取私密信息,盗用资源, 拒绝服务/破坏, …
</code></pre>

            </section>
        
            <section >
                <h2>恶意代码类型</h2>
<pre><code>- 计算机病毒, 蠕虫, 恶意移动代码, 后门, 特洛伊木马, 僵尸程序, Rootkit等…
- 计算机病毒是最早出现的恶意代码，媒体/工业界的概念混淆，经常以计算机病毒(Computer Virus)等价于恶意代码
</code></pre>

            </section>
        
            <section >
                <h2>恶意代码类型</h2>
<table>
<thead>
<tr>
<th>恶意代码类型</th>
<th>定义特征</th>
<th>典型实例</th>
</tr>
</thead>
<tbody>
<tr>
<td>计算机病毒（<strong>Virus</strong>）</td>
<td>通过感染文件**(<strong>可执行文件、数据文件、电子邮件等</strong>)</td>
<td><strong>Brain,Concept,</strong></td>
</tr>
<tr>
<td></td>
<td>通过磁盘引导扇区进行传播，一般需要宿主程序被执行或人为交互才能运行</td>
<td><strong>CIH</strong></td>
</tr>
<tr>
<td>蠕虫（<strong>Worm</strong>）</td>
<td>一般为不需要宿主的单独文件，通过网络传播，自动复制，通常无需人为交互便可感染传播</td>
<td><strong>Red,Slammer</strong> <strong>Morris,Code</strong></td>
</tr>
<tr>
<td>恶意移动代码（<strong>Malicious mobilecode</strong></td>
<td>从远程主机下载到本地执行的轻量级恶意代码，不需要或仅需要极少的人为干预。代表性的开发工具有<strong>JavaScript</strong>，<strong>VBScript</strong>，<strong>Java</strong>，以及<strong>ActiveX</strong></td>
<td><strong>SantyWorm</strong></td>
</tr>
<tr>
<td>后门（<strong>Backdoor</strong>）</td>
<td>绕过正常的安全控制机制，从而为攻击者提供访问途径</td>
<td><strong>Netcat,BO,冰河</strong></td>
</tr>
<tr>
<td>特洛伊木马(Trojan)</td>
<td>伪装成有用软件，隐藏其恶意目标，欺骗用户安装执行</td>
<td><strong>Setiri</strong></td>
</tr>
<tr>
<td>僵尸程序(Bot)</td>
<td>使用一对多的命令与控制机制组成僵尸网络</td>
<td><strong>Sdbot,Agobot</strong></td>
</tr>
<tr>
<td>内核套件(Rootkit)</td>
<td>通过替换或修改系统关键可执行文件（用户态），或者通过控制操作系统内核(<strong>内核态</strong>)用以获取并保持最高控制权(rootaccess)</td>
<td><strong>LRK,FU,hdef</strong></td>
</tr>
<tr>
<td>融合型恶意代码</td>
<td>融合上述多种恶意代码技术，构成更具破坏性的恶意代码形态</td>
<td><strong>Nimda</strong></td>
</tr>
</tbody>
</table>

            </section>
        

    </section>
    



    
        <section >
            
            <h1>系统监控</h1>
<ul>
<li>
<p>把系统看做一个黑盒子</p>
<ul>
<li>从网络进出口，监控对外数据收发</li>
</ul>
</li>
<li>
<p>把系统看做白盒子</p>
<ul>
<li>谁（进程）</li>
<li>读写了什么（文件）</li>
<li>收发了什么（网络）</li>
</ul>
</li>
<li>
<p>隐通道</p>
<ul>
<li><a href="https://zhuanlan.zhihu.com/p/337646492">内存发送Wifi信号</a></li>
<li><a href="https://zhuanlan.zhihu.com/p/88728822">DNS包发送数据</a></li>
<li>…</li>
</ul>
</li>
</ul>

            </section>
    



    
    <section>
        <section >
            <h1>静态分析</h1>
<blockquote>
<p>已得到要分析的代码</p>
</blockquote>
<table>
<thead>
<tr>
<th>分析方法</th>
<th>目的</th>
<th>使用工具</th>
<th>难度</th>
</tr>
</thead>
<tbody>
<tr>
<td>恶意代码扫描</td>
<td>标识已知恶意代码</td>
<td>反病毒引擎,VirusTotal</td>
<td>低</td>
</tr>
<tr>
<td>文件格式识别</td>
<td>确定攻击平台和类型</td>
<td>file,peid,FileAnalyzer</td>
<td>低</td>
</tr>
<tr>
<td>字符串提取</td>
<td>寻找恶意代码分析线索</td>
<td>Strings</td>
<td>低</td>
</tr>
<tr>
<td>二进制结构分析</td>
<td>初步了解二进制文件结构</td>
<td>binutils(nm,objdump)</td>
<td>中</td>
</tr>
<tr>
<td>反汇编</td>
<td>二进制代码-&gt;汇编代码</td>
<td>IDAPro,GDB,VC,…</td>
<td>中高</td>
</tr>
<tr>
<td>反编译</td>
<td>汇编代码-&gt;高级语言</td>
<td>REC,DCC,JAD,…</td>
<td>中高</td>
</tr>
<tr>
<td>代码结构与逻辑分析</td>
<td>分析二进制代码组，理解二进制代码逻辑成结构</td>
<td>IDAPro,Ollydbg,…</td>
<td>高</td>
</tr>
<tr>
<td>加壳识别和代码脱壳</td>
<td>识别是否加壳及类型；对抗代码混淆恢复原始代码</td>
<td>UPX,VMUnpacker,手工</td>
<td>高</td>
</tr>
</tbody>
</table>

            </section>
        
            <section >
                <pre><code class="language-bash">
└─$ file _backdoor.exe 
_backdoor.exe: PE32 executable (GUI) Intel 80386, for MS Windows
└─$ strings _backdoor.exe | more
!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.rsrc
SSShL@A

</code></pre>

            </section>
        

    </section>
    



    
        <section >
            
            <h1>动态分析</h1>
<table>
<thead>
<tr>
<th>分析方法</th>
<th>目的</th>
<th>使用工具</th>
<th>难度</th>
</tr>
</thead>
<tbody>
<tr>
<td>快照比对</td>
<td>获取恶意代码行为结果</td>
<td>FileSnap,RegSnap,完美卸载</td>
<td>低</td>
</tr>
<tr>
<td>动态行为监控(APIHooking)</td>
<td>实时监控恶意代码动态行为轨迹</td>
<td>Filemon,Regmon,ProcessExplorer,lsof…</td>
<td>中</td>
</tr>
<tr>
<td>网络监控</td>
<td>分析恶意代码网络监听端口及发起网络会话</td>
<td>Fport,lsof,TDImon,ifconfig,tcpdump,…</td>
<td>中</td>
</tr>
<tr>
<td>沙盒(sandbox)</td>
<td>在受控环境下进行完整的恶意代码动态行为监控与分析</td>
<td>NormanSandbox,CWSandbox,FVMSandbox,…</td>
<td>中高</td>
</tr>
<tr>
<td>动态跟踪调试</td>
<td>单步调试恶意代码程序，理解程序结构和逻辑</td>
<td>Ollydbg,IDAPro,gdb,SoftICE,systrace,…</td>
<td>高</td>
</tr>
</tbody>
</table>

            </section>
    



    
        <section >
            
            <h1>监控与分析工具</h1>
<blockquote>
<p>应使用完全隔离的环境进行恶意代码分析</p>
</blockquote>
<ul>
<li>系统内置指令、日志等
<ul>
<li>netstat</li>
</ul>
</li>
<li>系统官方套件
<ul>
<li>win: <a href="https://docs.microsoft.com/en-us/sysinternals/">sysinternals</a></li>
</ul>
</li>
<li><a href="https://github.com/sandboxie-plus/Sandboxie">Windows应用 Sandboxie plus</a></li>
<li><a href="https://zhuanlan.zhihu.com/p/53849618">Win10内置Sandbox</a></li>
<li><a href="https://zhuanlan.zhihu.com/p/187505981">轻量级容器Docker</a></li>
<li>虚拟机(VMWare, Visual Box)</li>
</ul>

            </section>
    



    
        <section >
            
            <h1>系统监控实验</h1>
<ul>
<li>优先级
<ul>
<li>1.原生指令或日志</li>
<li>2.官方软件</li>
<li>3.第三方软件或工具</li>
</ul>
</li>
<li>实验内容
<ul>
<li>netstat监控网络</li>
<li>sysmon监控系统运行</li>
<li>sysinternals及其他工具分析恶意软件</li>
</ul>
</li>
</ul>

            </section>
    


    </div>


  </div>

  	
	<script src="libs/reveal.js/4.1.3/reveal.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/zoom/zoom.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/notes/notes.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/search/search.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/markdown/markdown.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/highlight/highlight.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/menu/menu.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/math/math.js"></script>

	<script src="libs/reveal.js/4.1.3/plugin/fullscreen/plugin.js"></script>
  
  	<script src="libs/reveal.js/4.1.3/plugin/animate/plugin.js"></script>
  	<script src="libs/reveal.js/4.1.3/plugin/animate/svg.min.js"></script>
  
  	<script src="libs/reveal.js/4.1.3/plugin/anything/plugin.js"></script>
	  <script src="libs/reveal.js/4.1.3/plugin/anything/Chart.min.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/anything/d3/d3.v3.min.js"></script>				
	<script src="libs/reveal.js/4.1.3/plugin/anything/d3.patch.js"></script>			
	<script src="libs/reveal.js/4.1.3/plugin/anything/d3/queue.v1.min.js"></script>		
	<script src="libs/reveal.js/4.1.3/plugin/anything/d3/topojson.v1.min.js"></script>		
	<script src="libs/reveal.js/4.1.3/plugin/anything/function-plot.js"></script>

 <!--	<script src="libs/reveal.js/4.1.3/plugin/audio-slideshow/plugin.js"></script>  -->
<!--	<script src="libs/reveal.js/4.1.3/plugin/audio-slideshow/recorder.js"></script>-->
<!--	<script src="libs/reveal.js/4.1.3/plugin/audio-slideshow/RecordRTC.js"></script>-->

<script src="libs/reveal.js/4.1.3/plugin/chalkboard/plugin.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/customcontrols/plugin.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/embed-tweet/plugin.js"></script>

	<script src="libs/reveal.js/4.1.3/plugin/chart/chart.min.js"></script>
	<script src="libs/reveal.js/4.1.3/plugin/chart/plugin.js"></script>

  <script>

		const printPlugins = [
			RevealNotes, 
			RevealHighlight,
			RevealMath,
			RevealAnimate,
			RevealChalkboard, 
			RevealEmbedTweet,
			RevealChart,
		];

		const plugins =  [...printPlugins,
		RevealZoom, 
		RevealSearch, 
				RevealMarkdown, 
				RevealMenu, 
				RevealFullscreen,
				RevealAnything,
				//RevealAudioSlideshow,
				//RevealAudioRecorder,
				RevealCustomControls, 
				// poll
				// question
				// seminar
				 ]


		// Also available as an ES module, see:
		// https://revealjs.com/initialization/
		Reveal.initialize({
			controls: true,
			controlsTutorial: true,
			controlsLayout: 'bottom-right',
			controlsBackArrows: 'faded',
			progress: true,
			slideNumber: false,
			//#showSlideNumber "all" "print" "speaker"
			hash: true,//#  hash: false,
			//# respondToHashChanges: true,
			//# history: false,
			keyboard: true,
			//#keyboardCondition: null,
			overview: true,
			center: true,
			touch: true,
			loop: false,
			rtl: false,
			//#navigationMode: 'default', linear grid
			shuffle: false,
			fragments: true,
			fragmentInURL: false,
			embedded: false,
			help: true,
			//#pause: true
			showNotes: false,
			autoPlayMedia: false, // TODO fix this to a nullable value
			//#preloadIframes: null. true false
			//#autoAnimate: true
			//#autoAnimateMatcher: null,
			//#autoAnimateEasing: 'ease',
			//autoAnimateDuration: 1.0,
			//#autoAnimateUnmatched: true
			//#autoAnimateStyles: []
			autoSlide: 0, // TODO fix this to a falseable value
			autoSlideStoppable: true,
			autoSlideMethod: '0',
			defaultTiming: 120,
			mouseWheel: false,
			//#previewLinks: false
			//#postMessage: true,  // TODO : this can cause issues with the vscode api ???
			//#postMessageEvents: false,
			//#focusBodyOnPageVisibilityChange: true,
			transition: 'slide',
			transitionSpeed: 'default',
			backgroundTransition: 'fade',
			//#pdfMaxPagesPerSlide: Number.POSITIVE_INFINITY,
			//#pdfSeparateFragments: true,
			//#pdfPageHeightOffset: -1,
			viewDistance: 3,
			//#mobileViewDistance: 2,
			display: 'block',
			//#hideInactiveCursor: true,
			//#hideCursorTime: 5000

			// Parallax Background
			parallaxBackgroundImage: '',
			parallaxBackgroundSize: '',
			parallaxBackgroundHorizontal: 0,
			parallaxBackgroundVertical: 0,
			
			//Presentation Size
			width: 960,
			height: 700,
			margin: 0.04,
			minScale: 0.2,
			maxScale: 2,
			disableLayout: false,

			audio: {
				prefix: 'audio/', 	// audio files are stored in the "audio" folder
				suffix: '.ogg',		// audio files have the ".ogg" ending
				textToSpeechURL: null,  // the URL to the text to speech converter
				defaultNotes: false, 	// use slide notes as default for the text to speech converter
				defaultText: false, 	// use slide text as default for the text to speech converter
				advance: 0, 		// advance to next slide after given time in milliseconds after audio has played, use negative value to not advance
				autoplay: false,	// automatically start slideshow
				defaultDuration: 5,	// default duration in seconds if no audio is available
				defaultAudios: true,	// try to play audios with names such as audio/1.2.ogg
				playerOpacity: 0.05,	// opacity value of audio player if unfocused
				playerStyle: 'position: fixed; bottom: 4px; left: 25%; width: 50%; height:75px; z-index: 33;', // style used for container of audio controls
				startAtFragment: false, // when moving to a slide, start at the current fragment or at the start of the slide
			},
			
			chalkboard: { // font-awesome.min.css must be available
					//src: "chalkboard/chalkboard.json",
					storage: "chalkboard-demo",
				},
			
			customcontrols: {
					controls: [
      						{
						  id: 'toggle-overview',
						  title: 'Toggle overview (O)',
						  icon: '<i class="fa fa-th"></i>',
						  action: 'Reveal.toggleOverview();'
						}
						,
						{ icon: '<i class="fa fa-pen-square"></i>',
						  title: 'Toggle chalkboard (B)',
						  action: 'RevealChalkboard.toggleChalkboard();'
						},
						{ icon: '<i class="fa fa-pen"></i>',
						  title: 'Toggle notes canvas (C)',
						  action: 'RevealChalkboard.toggleNotesCanvas();'
						}
				]
			},
			chart: {
					defaults: { 
						color: 'lightgray', // color of labels
						scale: { 
							beginAtZero: true, 
							ticks: { stepSize: 1 },
							grid: { color: "lightgray" } , // color of grid lines
						},
					},
					line: { borderColor: [ "rgba(20,220,220,.8)" , "rgba(220,120,120,.8)", "rgba(20,120,220,.8)" ], "borderDash": [ [5,10], [0,0] ] }, 
					bar: { backgroundColor: [ "rgba(20,220,220,.8)" , "rgba(220,120,120,.8)", "rgba(20,120,220,.8)" ]}, 
					pie: { backgroundColor: [ ["rgba(0,0,0,.8)" , "rgba(220,20,20,.8)", "rgba(20,220,20,.8)", "rgba(220,220,20,.8)", "rgba(20,20,220,.8)"] ]},
					radar: { borderColor: [ "rgba(20,220,220,.8)" , "rgba(220,120,120,.8)", "rgba(20,120,220,.8)" ]}, 
			},
			math: {
				mathjax: 'https://cdn.jsdelivr.net/gh/mathjax/mathjax@2.7.8/MathJax.js',
				config: 'TeX-AMS_HTML-full',
				// pass other options into `MathJax.Hub.Config()`
				TeX: { Macros: { RR: "{\\bf R}" } }
				},
				anything: [ 
				{
		className: "plot",
		defaults: {width:500, height: 500, grid:true},
		initialize: (function(container, options){ options.target = "#"+container.id; functionPlot(options) })
	 },
	 {
		className: "chart",  
		initialize: (function(container, options){ container.chart = new Chart(container.getContext("2d"), options);  })
	 },
	 {
		className: "anything",
		initialize: (function(container, options){ if (options && options.initialize) { options.initialize(container)} })
	 },
					],
			// Learn about plugins: https://revealjs.com/plugins/
			plugins: (window.location.search.match(/print-pdf/gi) ? printPlugins : plugins ) 
		});
			


	    // Change chalkboard theme : 
		function changeTheme(input) {
			var config = {};
			config.theme = input.value;
			Reveal.getPlugin("RevealChalkboard").configure(config);
			input.blur();
		}

		// // Handle the message inside the webview
        // window.addEventListener('message', event => {

        //     const message = event.data; // The JSON data our extension sent

        //     switch (message.command) {
        //         case 'refactor':
        //             Reveal.toggleHelp();
        //     }
        // });

		if (window.location.search.match(/print-pdf-now/gi)) {
      		setTimeout(() => {
				window.print();
			  }, 2500);
			
    }
		

	</script>

</body>

</html>